Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-43798

CVE-2021-43798HIGH

Grafana path traversal

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  N  N    7.5   .8850   99.8   YES

AFFECTED
  Product  Versions             Fixed
  grafana  >= 8.0.0, < 8.0.7 –  —

TIMELINE
  Nov 16  Reserved by GitHub_M
  Dec 7   Published (CNA: GitHub_M)
  Oct 9   Added to CISA KEV, remediation due 2025-10-30

CWE-22 · CNA: GitHub_M · CVSS v3.1 · 9 references · KEV due October 30, 2025

Description

Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
November 16, 2021	Reserved	Reserved by GitHub_M
December 7, 2021	Published	Published (CNA: GitHub_M)
October 9, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-10-30

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
grafana	grafana	—	>= 8.0.0, < 8.0.7	—

Weaknesses

CWE-22

References (9)

http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html [x_refsource_MISC]
http://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.html [x_refsource_MISC]
http://www.openwall.com/lists/oss-security/2021/12/09/2 [mailing-list, x_refsource_MLIST]
http://www.openwall.com/lists/oss-security/2021/12/10/4 [mailing-list, x_refsource_MLIST]
https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545ce [x_refsource_MISC]
https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p [x_refsource_CONFIRM]
https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/ [x_refsource_CONFIRM]
https://security.netapp.com/advisory/ntap-20211229-0004/ [x_refsource_CONFIRM]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798 [government-resource]

Authoritative record: CVE-2021-43798 at cve.org

Vendors: grafana

Weaknesses: CWE-22

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-43798 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.